BuildAIPolicy

Australia · 10 December 2026 · 45 days to go

Australia's new rule on automated decisions

From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when computer programs, including AI, make or help make decisions that could significantly affect people.

The checker is free and takes about two minutes.

What's changing

New Australian Privacy Principles 1.7 to 1.9 apply when all three of these are true:

  1. 1Your organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making it.
  2. 2The decision could reasonably be expected to significantly affect someone's rights or interests.
  3. 3Personal information about that person is used in running the program.

What your privacy policy must say

If the rule applies, your privacy policy needs to describe:

  • the kinds of personal information used by these programs
  • the kinds of decisions made by the programs alone
  • the kinds of decisions the programs help make

It's broader than it sounds

  • Not just AI. The OAIC's guidance covers rule-based systems, AI and machine learning, and everyday software, including spreadsheets.
  • A person in the loop isn't an exemption. Programs that score, rank or recommend, where a person then decides, can still be covered.
  • Significant decisions take many forms. Examples include decisions about jobs, credit, insurance, housing, health, benefits, access to important services, and rights under a contract. Good and bad effects both count, and so does deciding not to act.

Who it applies to

Organisations covered by the Privacy Act (“APP entities”): Australian Government agencies, businesses and not-for-profits with an annual turnover above A$3 million, and some smaller businesses that are covered whatever their turnover, such as health service providers.

How to prepare

Most of the work is knowing which tools you use and what they decide.

1. List your tools

Every AI tool and other program your organisation uses, who uses it, and for what.

2. Find the decisions

Which of those tools make or help make decisions about people, and what personal information they use.

3. Update and govern

Describe those decisions in your privacy policy, and set rules so staff use AI tools safely.

How BuildAIPolicy can help

The AI Policy & Risk Pack is written from your answers about how your organisation uses AI. It gives you the groundwork: an AI tool inventory, a risk register, an AI acceptable use policy and sample transparency wording. It doesn't rewrite your privacy policy for you, and it isn't legal advice. Preview every section free before you pay.

Questions

When does the rule start?

On 10 December 2026. It applies to decisions made from that date, including where the personal information was collected earlier.

Does it only apply to AI?

No. It covers computer programs generally: AI tools, automated rules, scoring or ranking tools and, according to the OAIC's guidance, even spreadsheets when they make a decision or do something closely tied to making one.

We have a person check every decision. Are we outside the rule?

Not necessarily. The rule also covers programs that do something substantially and directly related to making a decision, such as scoring or recommending, even when a person makes the final call.

Does it apply to small businesses?

Most businesses with an annual turnover of A$3 million or less aren't covered by the Privacy Act, so the rule generally doesn't apply to them. Some are covered whatever their turnover, such as health service providers. The checker asks about these.

What do we need to do?

If the rule applies, your privacy policy needs to describe the kinds of personal information your programs use, the kinds of decisions they make alone, and the kinds of decisions they help make.

Sources

This page is a general summary of Privacy Act 1988 (Cth), Australian Privacy Principles 1.7 to 1.9, last checked against these sources on 26 October 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.